import{a as l}from"./chunk-3T4EOSMQ.js";import{i as d}from"./chunk-WI7DO2VU.js";import{b as c}from"./chunk-TX7AAHER.js";import"./chunk-FSRPMVAS.js";import{readFileSync as _}from"fs";var a=e=>async t=>{e.logger?.debug("@aws-sdk/credential-provider-web-identity - fromWebToken");let{roleArn:o,roleSessionName:r,webIdentityToken:s,providerId:n,policyArns:g,policy:p,durationSeconds:E}=e,{roleAssumerWithWebIdentity:i}=e;if(!i){let{getDefaultRoleAssumerWithWebIdentity:f}=await import("./sts-RJ2HDNHF.js");i=f({...e.clientConfig,credentialProviderLogger:e.logger,parentClientConfig:{...t?.callerClientConfig,...e.parentClientConfig}},e.clientPlugins)}return i({RoleArn:o,RoleSessionName:r??`aws-sdk-js-session-${Date.now()}`,WebIdentityToken:s,ProviderId:n,PolicyArns:g,Policy:p,DurationSeconds:E})};var m="AWS_WEB_IDENTITY_TOKEN_FILE",S="AWS_ROLE_ARN",N="AWS_ROLE_SESSION_NAME",w=(e={})=>async t=>{e.logger?.debug("@aws-sdk/credential-provider-web-identity - fromTokenFile");let o=e?.webIdentityTokenFile??process.env[m],r=e?.roleArn??process.env[S],s=e?.roleSessionName??process.env[N];if(!o||!r)throw new c("Web identity configuration not specified",{logger:e.logger});let n=await a({...e,webIdentityToken:d?.getTokenRecord?.()[o]??_(o,{encoding:"ascii"}),roleArn:r,roleSessionName:s})(t);return o===process.env[m]&&l(n,"CREDENTIALS_ENV_VARS_STS_WEB_ID_TOKEN","h"),n};export{w as fromTokenFile,a as fromWebToken};
